动态自学习的入侵检测模型研究  

Research on dynamic self-learning intrusion detection model

作　　者：王加民[1] 闫仁武[1] 王继凤[2] 李从[1] 雷艳云[1] 

机构地区：[1]江苏科技大学计算机科学与工程学院,江苏镇江212003 [2]淮安信息职业技术学院,江苏淮安223003

出　　处：《计算机工程与设计》2009年第11期2660-2662,共3页Computer Engineering and Design

摘　　要：针对目前常见的入侵检测的模型的一些结构性的缺点,提出了基本数据挖掘的动态自学习入侵检测模型DMIDS,给出了动态自学习的正常行为库的更新机制,克服了传统静态检测模型必须完全重新学习才能更新模型甚至无法重新学习的缺陷。通过基于KDD’99数据集的实验,表明其相对于传统的异常检测方法在保证较高检测率的前提下,有效地降低了误报率。It has a few configuration disadvantages in the current popular intrusion detection system. The dynamic self-learning intrusion detection model DMIDS based on envisaging this configuration disadvantage is brought forward. And the renewal mechanism of the dynamic self-learning normal behavior database is presented. This model overcomes the disadvantage that the traditional static detecting model must relearn over all the old and new examples, even can not relearn because of limited memory size. The proof from the test based on KDD＇ 99 attests this model DMIDS reduce the error ratio effectively comparing with the traditional anomaly detection under the precondition of pledging the rate of detection.

关 键 词：网络安全 异常检测 数据挖掘 入侵检测 动态自学习 

分 类 号：TP309.08[自动化与计算机技术—计算机系统结构]